"ASSERTION: wrong node" and crash [@ nsIRange::UnregisterCommonAncestor]

RESOLVED FIXED in mozilla12

Status

()

defect
--
critical
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: jruderman, Assigned: mats)

Tracking

(Blocks 1 bug, {assertion, crash, testcase})

Trunk
mozilla12
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [inbound])

Attachments

(4 attachments)

Reporter

Description

8 years ago
Closing the testcase triggers:

###!!! ASSERTION: wrong node: 'aNode->IsCommonAncestorForRangeInSelection()', file /builds/slave/m-cen-osx64-dbg/build/content/base/src/nsRange.cpp, line 429

Crash [@ nsIRange::UnregisterCommonAncestor]
Reporter

Comment 1

8 years ago
Posted file stack trace
Assignee

Comment 2

8 years ago
The text nodes we're normalizing are children of the document, so we're falsely
triggering aNotInsertedYet==true in nsRange::CharacterDataChanged:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#556
because I should have used GetNodeParent(), not GetParent().  Bah!

Try results pending:
https://tbpl.mozilla.org/?tree=Try&rev=5b0e7f840554
Assignee: nobody → matspal
OS: Mac OS X → All
Hardware: x86_64 → All
Assignee

Comment 3

8 years ago
Posted patch fixSplinter Review
Attachment #585853 - Flags: review?(bugs)
Assignee

Comment 4

8 years ago
Posted patch crashtestSplinter Review
Attachment #585853 - Flags: review?(bugs) → review+
Assignee

Comment 5

8 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/cddeb9fcc249
https://hg.mozilla.org/integration/mozilla-inbound/rev/db09603b4186
Flags: in-testsuite+
Keywords: crash
Whiteboard: [inbound]
Target Milestone: --- → mozilla12
You need to log in before you can comment on or make changes to this bug.